CVE-2026-74342

A flaw was found in the Linux kernel's kernfs file system. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by triggering a NULL pointer dereference. The issue occurs when the kernfs security initialization hook is invoked before critical parent node information is properly set, leading to a kernel panic. This can be deterministically reproduced on systems with SELinux enabled during cgroup directory creation.

This vulnerability is rated as having a Moderate security impact because an attack requires local system access and only results in a denial of service (system crash) rather than privilege escalation or unauthorized data access. On standard Red Hat Enterprise Linux deployments where SELinux is enabled, creating nested control group directories triggers an unhandled null pointer dereference within the kernel filesystem framework. Although this defect precipitates a kernel panic, the impact is strictly confined to system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.